SUIM identify roles with restriction in P_ORGIN PERSK

Hi all,
I'm trying to identify role in SUIM which have a restriction in object P_ORGIN in employee subgroup (PERSK). I need the roles which have the restriction for the values 6-19 because I have to enhance the restriction to 6-22.
Is there an option to solve this easily.
Thx

There is no option available in SUIM for "not equal to" selections of the object details nor specifying a range which must be inclusive of only that exact range. Unfortunately the latter is possible in authorizations.
Other than checking your own documentation, you will need to do digging in the tables unfortunately.
> The roles that can access also for example 1, 2, 3 etc. shouldn't be shown as result.
What about from '1' to "26"? If that that is not to be included and you only want those with a range of exactly from "6" to "19" then I would sync the user tables and start from UST12 and map the authorizations back to the roles via the profiles. Others might differ in opinion, because there are other tables as well.
Cheers,
Julius

Similar Messages

Creation of roles with restricted access to infoarea

HI !
We need to create some custom roles in BW, which will restrict the user (with that role) to access only specific infoareas in BW, i.e. the reports and Infoproviders etc created under those InfoAreas.
When I tried to create a role in tcode PFCG, I dont get any such options to restrict by InfoArea. Do we have to create custom Authorization objects for this and assign them to this role? if yes, how do we create such Authorization objects?
I am totally new to roles/profiles etc... i read the online documentations, but cudnt understand them much.
Please provide the steps to do this.
Thanks,
SUshmita

hi Sushmita,
try authorization object S_RS_COMP - business explorer compnent (under RS - business information warehouse),
you can specify infoarea, infocube
hope this helps.

My itunes does not open. I receive this error message:unsafe use of @executable_path in /Applications/iTunes.app/Contents/MacOS/iTunes with restricted binary

Process: iTunes [6564]
Path: /Applications/iTunes.app/Contents/MacOS/iTunes
Identifier: com.apple.iTunes
Version: 10.3.1 (10.3.1)
Build Info: iTunes-10315501~1
Code Type: X86 (Native)
Parent Process: launchd [143]
Date/Time: 2011-06-26 09:12:25.888 -0400
OS Version: Mac OS X 10.7 (11A390)
Report Version: 8
Sleep/Wake UUID: 57AD9B95-8923-403C-BDB2-EBBBD4E1F09C
Interval Since Last Report: 40546 sec
Crashes Since Last Report: 6
Per-App Crashes Since Last Report: 5
Anonymous UUID: 0B83B69E-63F7-4197-908B-49A24783F09F
Crashed Thread: 0
Exception Type: EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000002, 0x0000000000000000
Application Specific Information:
@executable_path/../Frameworks/iPodUpdater.framework/Versions/A/iPodUpdater
Dyld Error Message:
Library not loaded: @executable_path/../Frameworks/iPodUpdater.framework/Versions/A/iPodUpdater
Referenced from: /Applications/iTunes.app/Contents/MacOS/iTunes
Reason: unsafe use of @executable_path in /Applications/iTunes.app/Contents/MacOS/iTunes with restricted binary
Binary Images:
 0x1000 - 0xe50ff3 com.apple.iTunes (10.3.1 - 10.3.1) <DA5B3668-53FC-8550-A39C-06EB35AA692F> /Applications/iTunes.app/Contents/MacOS/iTunes
0x8fe00000 - 0x8fe3320b dyld (195 - ???) <33A6763E-295E-3FE1-9594-81B9E296BACC> /usr/lib/dyld
Model: MacBookPro7,1, BootROM MBP71.0039.B0B, 2 processors, Intel Core 2 Duo, 2.4 GHz, 4 GB, SMC 1.62f6
Graphics: NVIDIA GeForce 320M, NVIDIA GeForce 320M, PCI, 256 MB
Memory Module: BANK 0/DIMM0, 2 GB, DDR3, 1067 MHz, 0x80CE, 0x4D34373142353637334648302D4346382020
Memory Module: BANK 1/DIMM0, 2 GB, DDR3, 1067 MHz, 0x80CE, 0x4D34373142353637334648302D4346382020
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x8D), Broadcom BCM43xx 1.0 5.100.198.11 )
Bluetooth: Version 2.5.0b13, 2 service, 19 devices, 3 incoming serial ports
Serial ATA Device: Hitachi HTS545025B9SA02, 250.06 GB
Serial ATA Device: MATSHITADVD-R UJ-898
USB Device: Internal Memory Card Reader, apple_vendor_id, 0x8403, 0x26100000 / 2
USB Device: Built-in iSight, apple_vendor_id, 0x8507, 0x24600000 / 2
USB Device: BRCM2046 Hub, 0x0a5c (Broadcom Corp.), 0x4500, 0x06600000 / 4
USB Device: Bluetooth USB Host Controller, apple_vendor_id, 0x8213, 0x06610000 / 6
USB Device: IR Receiver, apple_vendor_id, 0x8242, 0x06500000 / 3
USB Device: Apple Internal Keyboard / Trackpad, apple_vendor_id, 0x0236, 0x06300000 / 2

I have the same problem...
Process: iTunes [498]
Path: /Applications/iTunes.app/Contents/MacOS/iTunes
Identifier: com.apple.iTunes
Version: 10.3.1 (10.3.1)
Build Info: iTunes-10315501~1
Code Type: X86 (Native)
Parent Process: launchd [254]
Date/Time: 2011-06-27 14:23:04.822 -0400
OS Version: Mac OS X 10.7 (11A390)
Report Version: 8
Sleep/Wake UUID: AC114B5B-BBDE-47BE-A34A-73D0CBEC2D1D
Interval Since Last Report: 21605 sec
Crashes Since Last Report: 3
Per-App Crashes Since Last Report: 3
Anonymous UUID: 7CA002EB-2F78-46A8-B8FC-917C420125C9
Crashed Thread: 0
Exception Type: EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000002, 0x0000000000000000
Application Specific Information:
@executable_path/../Frameworks/iPodUpdater.framework/Versions/A/iPodUpdater
Dyld Error Message:
Library not loaded: @executable_path/../Frameworks/iPodUpdater.framework/Versions/A/iPodUpdater
Referenced from: /Applications/iTunes.app/Contents/MacOS/iTunes
Reason: unsafe use of @executable_path in /Applications/iTunes.app/Contents/MacOS/iTunes with restricted binary
Binary Images:
 0x1000 - 0xe50ff3 com.apple.iTunes (10.3.1 - 10.3.1) <DA5B3668-53FC-8550-A39C-06EB35AA692F> /Applications/iTunes.app/Contents/MacOS/iTunes
0x8fe00000 - 0x8fe3320b dyld (195 - ???) <33A6763E-295E-3FE1-9594-81B9E296BACC> /usr/lib/dyld
Model: MacBook4,1, BootROM MB41.00C1.B00, 2 processors, Intel Core 2 Duo, 2.4 GHz, 2 GB, SMC 1.31f1
Graphics: Intel GMA X3100, GMA X3100, Built-In, 144 MB
Memory Module: BANK 0/DIMM0, 1 GB, DDR2 SDRAM, 667 MHz, 0xAD00000000000000, 0x48594D503131325336344350362D59352020
Memory Module: BANK 1/DIMM1, 1 GB, DDR2 SDRAM, 667 MHz, 0xAD00000000000000, 0x48594D503131325336344350362D59352020
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x88), Broadcom BCM43xx 1.0 (5.10.131.36.5)
Bluetooth: Version 2.5.0b13, 2 service, 19 devices, 1 incoming serial ports
Network Service: Ethernet, Ethernet, en0
Network Service: AirPort, AirPort, en1
Serial ATA Device: FUJITSU MHY2250BH, 250.06 GB
Parallel ATA Device: HL-DT-ST DVDRW GSA-S10N
USB Device: Built-in iSight, apple_vendor_id, 0x8501, 0xfd400000 / 2
USB Device: Bluetooth USB Host Controller, apple_vendor_id, 0x8205, 0x1a100000 / 2
USB Device: IR Receiver, apple_vendor_id, 0x8242, 0x5d100000 / 2
USB Device: Apple Internal Keyboard / Trackpad, apple_vendor_id, 0x0229, 0x5d200000 / 3

Create a role with everything except parameterization option

Hello,
We need to create a new role with all object except parameterization
option.
How we can create it?
Best regards,
Julene González

I had no idea that we had discussed SPRO that often...
As you can see from the thread Alex pointed out ( [this one|https://forums.sdn.sap.com/click.jspa?searchID=19779873&messageID=6581648] ) it is also usefull to know which system in the landscape this role is destined for.
Assuming this is for the QAS system, why don't you identify all the business roles for the production system (those which do not permit customizing in production either, nor user admin and other "basis" tasks, nor development work...etc...) and assign them all to the users (I assume these are support users).
They should be in QAS already, and if your client settings are correct (T), you will experience the same or a very similar result.
Of course they won't have "SAP_ALL minus SPRO", but they will have what you are actually using for the "real users"... in production (except it will be in QAS).
That way they have also have a more realistic testing experience with the correct roles (only).
Just a thought,
Julius

Create Roles with acess control in SAP MDM

Hi Experts,
I am new to SAP MDM.I want to know how to create roles with access control for various users in SAP MDM.
Thanks,
Manoj

hi,
in the console; you can create roles with access control and you can assign these roles to users.
follow this path:
Console --> repository --> Admin node --> roles,
here you can create new role. for role here you can maintain
1. role detail
2. Functions --here you can restrict the particular role , none / Execute the functions.
3. Tables/fields -- here you can give access to the role Read only / Read and write, and you can apply constraints also.
and follow the links:
http://help.sap.com/saphelp_mdm550/helpdata/en/8e/9f9c427055c66ae10000000a155106/frameset.htm
http://help.sap.com/saphelp_mdm550/helpdata/en/8e/9f9c427055c66ae10000000a155106/frameset.htm
http://help.sap.com/saphelp_mdm550/helpdata/en/8e/9f9c427055c66ae10000000a155106/frameset.htm
http://help.sap.com/saphelp_mdm550/helpdata/en/8e/9f9c427055c66ae10000000a155106/frameset.htm
http://help.sap.com/saphelp_mdm550/helpdata/en/8e/9f9c427055c66ae10000000a155106/frameset.htm
hope this may help you,
Regards,
Srinivas

Default role with password - reality check

I support the database for an application. We upgraded from Oracle10 to Oracle11 9 months ago. Then recently we applied the OCT CPU.
The application admin says that they have a program that has recently stopped working that worked after the Oracle11 upgrade.
The application user has a default role which has a password. Is that possible? A default role with a password. Would this have ever worked in any version of Oracle?

Default role with password is a feature even available with Oracle XE. Default roles are activated without requiring role password in Oracle 10.2:
SQL> drop user admin cascade;
User dropped.
SQL> drop user test cascade;
User dropped.
SQL> drop role rwp;
Role dropped.
SQL> select * from v$version;
BANNER
Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product
PL/SQL Release 10.2.0.1.0 - Production
CORE 10.2.0.1.0 Production
TNS for 32-bit Windows: Version 10.2.0.1.0 - Production
NLSRTL Version 10.2.0.1.0 - Production
SQL>
SQL> create user admin identified by oraclexe;
User created.
SQL> grant create session, create table to admin;
Grant succeeded.
SQL> grant unlimited tablespace to admin;
Grant succeeded.
SQL> grant create user to admin;
Grant succeeded.
SQL> grant create role to admin;
Grant succeeded.
SQL>
SQL> create user test identified by oraclexe;
User created.
SQL> grant create session to test;
Grant succeeded.
SQL>
SQL> connect admin/oraclexe;
Connected.
SQL> create table t(x varchar2(10));
Table created.
SQL> insert into t values('admin OK');
1 row created.
SQL> commit;
Commit complete.
SQL> create role rwp identified by oraclexe;
Role created.
SQL> grant all on t to rwp;
Grant succeeded.
SQL> grant rwp to test;
Grant succeeded.
SQL>
SQL> connect test/oraclexe;
Connected.
SQL> select * from session_roles;
ROLE
RWP
SQL> select * from admin.t;
X
admin OK
SQL> insert into admin.t values('test OK');
1 row created.
SQL> commit;
Commit complete.
SQL> select * from admin.t;
X
admin OK
test OK
SQL>There have been changes between Oracle 10.2 and 11.2 because the same script fails in 11.2 unless the role is set with the password:
SQL> drop user admin cascade;
User dropped.
SQL> drop user test cascade;
User dropped.
SQL> drop role rwp;
Role dropped.
SQL> select * from v$version;
BANNER
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
PL/SQL Release 11.2.0.1.0 - Production
CORE 11.2.0.1.0 Production
TNS for Linux: Version 11.2.0.1.0 - Production
NLSRTL Version 11.2.0.1.0 - Production
SQL>
SQL> create user admin identified by oraclexe;
User created.
SQL> grant create session, create table to admin;
Grant succeeded.
SQL> grant unlimited tablespace to admin;
Grant succeeded.
SQL> grant create user to admin;
Grant succeeded.
SQL> grant create role to admin;
Grant succeeded.
SQL>
SQL> create user test identified by oraclexe;
User created.
SQL> grant create session to test;
Grant succeeded.
SQL>
SQL> connect admin/oraclexe;
Connected.
SQL> create table t(x varchar2(10));
Table created.
SQL> insert into t values('admin OK');
1 row created.
SQL> commit;
Commit complete.
SQL> create role rwp identified by oraclexe;
Role created.
SQL> grant all on t to rwp;
Grant succeeded.
SQL> grant rwp to test;
Grant succeeded.
SQL>
SQL> connect test/oraclexe;
Connected.
SQL> select * from session_roles;
no rows selected
SQL> select * from admin.t;
select * from admin.t
ERROR at line 1:
ORA-00942: table or view does not exist
SQL> insert into admin.t values('test OK');
insert into admin.t values('test OK')
ERROR at line 1:
ORA-00942: table or view does not exist
SQL> commit;
Commit complete.
SQL> select * from admin.t;
select * from admin.t
ERROR at line 1:
ORA-00942: table or view does not exist
SQL>
SQL> set role rwp identified by oraclexe;
Role set.
SQL> select * from session_roles;
ROLE
RWP
SQL> select * from admin.t;
X
admin OK
SQL> insert into admin.t values('test OK');
1 row created.
SQL> commit;
Commit complete.
SQL> select * from admin.t;
X
admin OK
test OK
SQL>10.2 Security Guide says:
If you are granted a role protected by a password, then you can enable or disable the role by supplying the proper password for the role in a SET ROLE statement. However, if the role is made a default role and enabled at connect time, then the user is not required to enter a password.
11.1 and 11.2 Secuirty Guide says:
If a user is granted a role protected by a password, then you can enable or disable the role by supplying the proper password for the role in the SET ROLE statement. You cannot authenticate a password-authenticated role on logon, even if you add it to the list of default roles. You must explicitly enable it with the SET ROLE statement using the required password.
Edited by: P. Forstmann on 20 févr. 2010 10:28

Mapping between the query/report and the role with technical names - BI Sec

Hi,
How to find the mapping between the query/report and the role with technical names ?
Like in R/3 we can find the mapping using table AGR_TCODES or thourgh SUIM. However in BI all reports have tcode RRMX.
So. how to find the role for a given query/report like sales report with technical names?

I looked into this quite a while ago and cannot remember the exact details, but I think there were 3 tables needed together with a structure to explore with a function module, and you need to use the program ID to think them.
If you look in SQ01 then I am sure you will find one of the tables, and then search from there onward.
Alternately, while searching you might find a nice report which does this for you.
Hope that helps and let us know whether you find it.
Cheers,
Julius

Mapping between the query/report and the role with technical names

Hi,
How to find the mapping between the query/report and the role with technical names ?
Like in R/3 we can find the mapping using table AGR_TCODES or thourgh SUIM. However in BI all reports have tcode RRMX.
So. how to find the role for a given query/report like sales report with technical names?
Edited by: Phoenix on Jul 26, 2008 4:15 PM

Posted in wrong forum

Copy role with published workbooks on it

Hi,
i have a role with 30 workbooks on it and i want to copy the role to another one and
restrict the access to just 25 workbooks, but when i copy the role the published workbooks
are not copied to the new role.
What's the best way to do this ?
thx in advance
JP

Hi,
Did you try to use Copy All option while copying the Role ?
Regards,
Gaurav

How to add a new user so it have the same access with restricted usertime

When i made a new useraccount to my daughter,with restricted usertime,she have probl.to get into the interned.
How can i make it possible to have the same look on her useraccount as mine as admin.but only with restricted usertime?
Brgds
O.Knutsen

Hi,
This should be very much possible.
Please see:
https://glassfish.dev.java.net/nonav/javaee5/amx/javadoc/index.html
Once you've got the domain-root, you should traverse and get a named "config",
using getConfigConfigMap("server-config") method and then get the
SecurityConfig out of that. Once you get the Security Config, you should get
the default realm using getDefaultRealm method and then it should be
possible for you to use addUser.
Please let me know if it helps.
Kedar

Data inconsistency: posting with restricted transaction type (FAA_POST047)

Hi colleagues!
I have the following error:
Data inconsistency: posting with restricted transaction type
Message no. FAA_POST047
Diagnosis
You are trying to post in company code 1000 with transaction type 130 in ledger group 0N. According to table TABWA, this transaction type is limited. Nonetheless, according to your entries, you want to post to area 11.
System Response
Using limited transaction types is obsolete and would lead to an inconsistent posting in this situation. The system rejects the posting.
Procedure
Use a transaction type that is not limited. And, if possible, choose the ledger group and/or depreciation area on the initial screen.
According to specific accounting we shouldn't post to one of the depr. area, so most of the tr.types are restricted to post to all areas except this one.
Because of this, posting from MM with acc.assignment 'A' is impossible - I have this error.
Any ideas how to solve?
Thanks in advance

Hi Anton
This looks like your transaction type -130 is limited to post only in ledger group-0N as per the transaction type configuration. Due to which system is unable to post all the ledgers and hence this lead to inconsistency.
Please verify the transaction type 130- in configuration T code - OAYA and see if it is restricted by depreciation area (eventually allow to post only ledger group- 0N.
Tcode - OAYA (Limit Transaction Types to Depreciation Areas)
please verify and let us know the update. hope this helps
Best Regards
Jomon

Report to see list of roles with no user assignment

Hi Gurus,
I need to know the transaction/Report where i can see list of roles which doesnt have any user assignment.
Pls help me

HII,
To search for roles with no users assignment u can run a report RSUSR070 AFTER EXECUTING TCODE SA38 in the progran field enter the name of the report and click execute button u get roles by complex selection criteria then scroll down and in the selection according to user assignments select without user assignment then cli ck execute button u will get the roles with no user assigments............
Thanks and regards

Mapping requirement about grouping with restriction

Hi,experts:
There is a complex mapping requirement.
There are 2 document types(A and B) in the source records.
I need collect the amount with the document which is type A.
The source records are as follows:
Doc_No Doc_Type Doc_Itm_No Amount
 0001 A 0010 3
 0001 A 0020 4
 0002 B 0010 5
 0002 B 0020 6
 0003 A 0010 11
 0003 A 0020 22
 The target records should be:
 Doc_No Doc_Type Amount
 0001 A 7
 0003 A 33
 The source and the target data type are the same as follows:
 Documents 1...unbound
 ---Doc_No 1...1
 ---Doc_Type 1...1
 ---Doc_Itm_No 1...1
 ---Amount 1...1
 Q1: How to create the target top node(Documents) with restriction(Doc_Type = 'A')?
 Without the restriction,i can handle it well as follows:
 removecontext(Doc_No)->sort->splitbyvalue(value changed)->collapsecontexts->Documents
 Q2:How to collect the amount?
Regards
Ming

hi ming,
do this mapping
Q1: How to create the target top node(Documents) with restriction(Doc_Type = "A")?
Doc_type-->(if equals "A")>(remove context)-->(createif)----->Documents
q2. How to collect the amount?
Doc_type(Documents context) + Amount(Document's context)--->UDF1>(SplitByValue)->Doc_type
Doc_type(Documents context) + Amount(Document's context)--->UDF2>(SplitByValue)-->Amount
//****************************UDF1***********************//
public void get_batch_name(String[] Doc_type,String[] Amount,ResultList result,Container container){
//write your code here
 Hashmap myHashmap=new Hashmap();
 for(int i=0; Doc_type.length(), Amount.length())
 if(myHashmap.get(Doc_type==null))
 {myHashmap.add(Doc_type, Amount);}
 else
 String amt= amt+myHashmap.get(Doc_type);
 myHashmap.put(Doc_type,amt);
 Set s=myHashmap.keySet();
 Iterator i=s.iterator();
 while(i.hasNext())
 result.addValue(i.next());
//********************UDF2***************************//
public void get_batch_name(String[] Doc_type,String[] Amount,ResultList result,Container container){
//write your code here
 Hashmap myHashmap=new Hashmap();
 for(int i=0; Doc_type.length(), Amount.length())
 if(myHashmap.get(Doc_type==null))
 {myHashmap.add(Doc_type, Amount);}
 else
 String amt= amt+myHashmap.get(Doc_type);
 myHashmap.put(Doc_type,amt);
 Arraylist s=myHashmap.values();
 String array[]=s.toArray();
 while(int i=0;i<array.length();i++)
 result.addValue(array);
Message was edited by: self
 sudeep dhar

Fail to create roles with users in LDAP

I installed and configured two Directory Services one for AM and one for identity. I created an LDAP Data Store for the root realm and can see the LDAP users in the Subjects->User tab in AM. I can create Subjects->Groups and add LDAP users successfully, but I cannot create Subjects->Roles with LDAP users. I get the following error:
Plug-in com.sun.identity.idm.plugins.files.FilesRepo: Unable to find entry: C:\SFU\app\ironscale\amserver\idRepo\user\awhite
Any ideas? I also found it odd that my new Group was created in the FileRepo under idRepo/group. I thought it would have been written to the AM DS.
I deleted the flat file Data Store and the Group/Roles tabs disappeared. Must I import additional LDIFS to my LDAP Identity DS to store roles and groups it that DS?

Update.
I deleted LDAPv3 Plug-in Supported Types and Operations values group, user, and role, based on Sun's Access Manager training class examples. I re-added them and deleted the File Data Store and groups now get created in the LDAP Identity repo. However when I create a role and add users the operation sucessfully completes. But I cannot find the roles using an LDAP browser. I can grep the role name from the LDAP database and the roles remain after restarting the db and AM. It appears AM is adding roles in a way other tools cannot see them.

Role with SPRO for FICO

Hello SAP EXperts,
Can anyone tell me how to create a role with SPRO authorization for FICO transactions and roles only. I need to assign a role with which a FICO consultant can do all the customizing related tasks in the development server. Please give some solution.
I invite your valuable inputs
Thanks & Regards
Vanitha
Edited by: Vanitha badampudi on Oct 21, 2008 1:33 PM
Edited by: Vanitha badampudi on Oct 21, 2008 1:36 PM

Hi there,
The easiest way to get all of the t-codes, is for a customising project to be created in the IMG with all of the relevant IMG activities assigned to it. (Your FI CO consultant can assist here.)
Once that has been done, you can go and create a role in PFCG. Select the menu tab, then select Utilities - Customizing Auth. and it will then ask you to select a customising project.
Once you've done that, all IMG activities and transactions for that customising project will automatically be entered into the menu.
You then need to go and maintain and generate the authorisations.
That's my suggestion.
Hope you can use it.
Regards
Lucille

SUIM identify roles with restriction in P_ORGIN PERSK

Similar Messages

Maybe you are looking for